Lydira

/security

Boring, on purpose.

You're about to upload your entire customer book into a new system. The least we owe you is a clear account of how it's kept: who can see what, where it lives, and how fast we can answer a regulator. No theatre, no badges we haven't earned.

01 / data

Where your data lives

Walled off from every other agency, kept in your country's region, encrypted at rest and in transit.

tenant isolation

Multi-tenant by design

Your data is separated by the database itself, not by a filter someone might forget to write.

  • Row-level security in the database keeps every agency's rows apart
  • Cross-tenant access is structurally prevented
  • The test suite asserts that isolation holds

data residency

Region-pinned or self-hosted

Your workspace lives in the region for your country, or in your own cloud.

  • Hosted on AWS in three regions: Istanbul for Türkiye, Frankfurt for Europe, North Virginia for the US
  • In Istanbul, servers, database, files and backups all stay in the country
  • For stricter regimes, run the same build in your own cloud
  • Per-tenant encryption contexts keep sensitive fields sealed, and one screen shows where your data lives and which controls are on

encryption

At rest and in transit

Everything is encrypted, and the most sensitive fields twice.

  • AES-256 at rest
  • TLS 1.2+ in transit
  • Passport numbers, integration credentials and similar fields carry their own encryption on top
  • Keys are derived per environment

02 / access

Who can get in and see what

Sign-in that asks for more than a password, permissions down to a single field, and a record of every change.

sign-in

More than a password

Stronger sign-in for every user, and full control over who stays signed in.

  • Two-step verification (TOTP + recovery codes) and passwordless sign-in links
  • Re-authentication before sensitive actions
  • A list of active sessions you can end remotely, and a per-account IP allowlist
  • SAML / OIDC single sign-on on Enterprise

access control

Modules, actions and field masking

Custom roles on top of owner, admin and member decide what each person can open, do and see.

  • Whole modules switch off (a closed module leaves the menu and won't open by typing the address)
  • Actions are permissioned one by one
  • Field masking hides cost, sell, personal data and passport numbers from roles that shouldn't see them
  • Masking holds in exports as well as on screen

audit trail

Versioned on every model

Every record keeps a history of who changed what, and when.

  • Every model is change-logged into a history scoped to your account
  • Old and new values on every save
  • Filterable by record type and user
  • Sign-in attempts and session events are recorded separately

03 / rights

Rights, AI and abuse

Deletion requests that finish properly, AI on your terms, and guardrails that stay out of the way.

erasure + retention

A deletion request that ends correctly

Every kind of subject request, carried through to a lawful end.

  • Access, rectification, erasure, portability, restriction and objection, plus the KVKK-specific types
  • Each runs end to end with an SLA countdown
  • On approval, records the law requires you to keep are retained with the personal data redacted
  • Leads and conversations carry no such duty, so they are deleted outright

ai governance

You decide what AI may touch

Switch it off, pin it to the EU, or keep it away from one customer entirely.

  • Disable AI per account, per feature or per data class, and pin an EU-only residency
  • Set a lawful basis per customer; choose "no processing" and no call is ever made about that person
  • Personal data is tokenised before it leaves for a provider, and every call is logged with its basis snapshotted
  • The embedding model behind semantic search runs on our own servers

abuse detection

Quiet, boring guardrails

Security that doesn't get in the operator's way.

  • Bot protection on the sign-in and sign-up forms
  • Sanctions-country blocks
  • Per-account IP allowlists
  • Rate limiting on sensitive actions

/compliance

Regulatory posture

KVKK
Türkiye

DPA template + sub-processor registry

GDPR
EU + UK

Art. 17 erasure + data export self-service

CCPA
California

right-to-delete honoured

Jurisdiction-specific DPAs are published at /legal/dpa; the live sub-processor list is at /legal/subprocessors. Data export and account-level erasure are self-service: no support ticket, no hostage-taking.

Due-diligence questions?

Security reviews and DPAs: reach the compliance desk directly at compliance@lydira.com.

Talk to us →Start free trial